cve-2026-45695

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45695.json"
      }
    ],
    "title": "github.com/kopia/kopia: Kopia: Arbitrary code execution via unauthenticated SFTP configuration in HTTP server.",
    "tracking": {
      "current_release_date": "2026-07-29T17:12:52+00:00",
      "generator": {
        "date": "2026-07-29T17:12:52+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "CVE-2026-45695",
      "initial_release_date": "2026-07-16T15:42:31.795000+00:00",
      "revision_history": [
        {
          "date": "2026-07-16T15:42:31.795000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-29T17:09:36+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-07-29T17:12:52+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Migration Toolkit for Containers",
                "product": {
                  "name": "Migration Toolkit for Containers",
                  "product_id": "migration_toolkit_for_containers",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhmt:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Migration Toolkit for Containers"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift API for Data Protection",
                "product": {
                  "name": "OpenShift API for Data Protection",
                  "product_id": "openshift_api_for_data_protection",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_api_data_protection:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenShift API for Data Protection"
          },
          {
            "category": "product_version",
            "name": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8",
            "product": {
              "name": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8",
              "product_id": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/openshift-migration-velero-plugin-for-mtc-rhel8?repository_url=registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "oadp/oadp-kubevirt-velero-plugin-rhel9",
            "product": {
              "name": "oadp/oadp-kubevirt-velero-plugin-rhel9",
              "product_id": "oadp/oadp-kubevirt-velero-plugin-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9?repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "oadp/oadp-mustgather-rhel9",
            "product": {
              "name": "oadp/oadp-mustgather-rhel9",
              "product_id": "oadp/oadp-mustgather-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/oadp-mustgather-rhel9?repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "oadp/oadp-rhel9-operator",
            "product": {
              "name": "oadp/oadp-rhel9-operator",
              "product_id": "oadp/oadp-rhel9-operator",
              "product_identification_helper": {
                "purl": "pkg:oci/oadp-rhel9-operator?repository_url=registry.redhat.io/oadp/oadp-rhel9-operator"
              }
            }
          },
          {
            "category": "product_version",
            "name": "oadp/oadp-velero-plugin-for-csi-rhel9",
            "product": {
              "name": "oadp/oadp-velero-plugin-for-csi-rhel9",
              "product_id": "oadp/oadp-velero-plugin-for-csi-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/oadp-velero-plugin-for-csi-rhel9?repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-csi-rhel9"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8 as a component of Migration Toolkit for Containers",
          "product_id": "migration_toolkit_for_containers:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8"
        },
        "product_reference": "rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8",
        "relates_to_product_reference": "migration_toolkit_for_containers"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-kubevirt-velero-plugin-rhel9 as a component of OpenShift API for Data Protection",
          "product_id": "openshift_api_for_data_protection:oadp/oadp-kubevirt-velero-plugin-rhel9"
        },
        "product_reference": "oadp/oadp-kubevirt-velero-plugin-rhel9",
        "relates_to_product_reference": "openshift_api_for_data_protection"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-mustgather-rhel9 as a component of OpenShift API for Data Protection",
          "product_id": "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9"
        },
        "product_reference": "oadp/oadp-mustgather-rhel9",
        "relates_to_product_reference": "openshift_api_for_data_protection"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-rhel9-operator as a component of OpenShift API for Data Protection",
          "product_id": "openshift_api_for_data_protection:oadp/oadp-rhel9-operator"
        },
        "product_reference": "oadp/oadp-rhel9-operator",
        "relates_to_product_reference": "openshift_api_for_data_protection"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-plugin-for-csi-rhel9 as a component of OpenShift API for Data Protection",
          "product_id": "openshift_api_for_data_protection:oadp/oadp-velero-plugin-for-csi-rhel9"
        },
        "product_reference": "oadp/oadp-velero-plugin-for-csi-rhel9",
        "relates_to_product_reference": "openshift_api_for_data_protection"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-45695",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
      },
      "discovery_date": "2026-07-16T16:01:37.730001+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501364"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Kopia, a cross-platform backup tool. An unauthenticated remote attacker can exploit the HTTP server, when started without a password, by sending specially crafted requests to the /api/v1/repo/exists endpoint. This allows the attacker to forward malicious SFTP storage configurations, which can lead to arbitrary code execution through OpenSSH commands.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/kopia/kopia: Kopia: Arbitrary code execution via unauthenticated SFTP configuration in HTTP server.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security considers this bug as Moderate as this requires active change of out of box configaration for this bug to be exploitable. There is no common use case under which Kopia HTTP server should be started without a password.\n\nThe diecrepancy in CVSS scores between Red Hat and NVD comes from the differences in User Interaction, Integrity and Availability. The core bug is merely an unintended information disclosure problem if exploited correctly. There is no way to launch a denial of service or affect the integrity of the service. Therefore the bug is scored lower.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "migration_toolkit_for_containers:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8",
          "openshift_api_for_data_protection:oadp/oadp-kubevirt-velero-plugin-rhel9",
          "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9",
          "openshift_api_for_data_protection:oadp/oadp-rhel9-operator",
          "openshift_api_for_data_protection:oadp/oadp-velero-plugin-for-csi-rhel9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45695"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501364",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501364"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45695",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45695"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45695",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45695"
        },
        {
          "category": "external",
          "summary": "https://github.com/kopia/kopia/commit/c26c6a1b9734c5089217986ffa5cd19f8a6b8900",
          "url": "https://github.com/kopia/kopia/commit/c26c6a1b9734c5089217986ffa5cd19f8a6b8900"
        },
        {
          "category": "external",
          "summary": "https://github.com/kopia/kopia/pull/5354",
          "url": "https://github.com/kopia/kopia/pull/5354"
        },
        {
          "category": "external",
          "summary": "https://github.com/kopia/kopia/releases/tag/v0.23.0",
          "url": "https://github.com/kopia/kopia/releases/tag/v0.23.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/kopia/kopia/security/advisories/GHSA-2q4c-3mrw-63c3",
          "url": "https://github.com/kopia/kopia/security/advisories/GHSA-2q4c-3mrw-63c3"
        }
      ],
      "release_date": "2026-07-16T15:42:31.795000+00:00",
      "remediations": [
        {
          "category": "workaround",
          "details": "This bug can be rendered unusable by making sure that --without-password is not included in startup options for Kopia HTTP server.",
          "product_ids": [
            "migration_toolkit_for_containers:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8",
            "openshift_api_for_data_protection:oadp/oadp-kubevirt-velero-plugin-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-rhel9-operator",
            "openshift_api_for_data_protection:oadp/oadp-velero-plugin-for-csi-rhel9"
          ]
        },
        {
          "category": "none_available",
          "details": "Fix deferred",
          "product_ids": [
            "migration_toolkit_for_containers:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8",
            "openshift_api_for_data_protection:oadp/oadp-kubevirt-velero-plugin-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-rhel9-operator",
            "openshift_api_for_data_protection:oadp/oadp-velero-plugin-for-csi-rhel9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "migration_toolkit_for_containers:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8",
            "openshift_api_for_data_protection:oadp/oadp-kubevirt-velero-plugin-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-rhel9-operator",
            "openshift_api_for_data_protection:oadp/oadp-velero-plugin-for-csi-rhel9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "migration_toolkit_for_containers:rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8",
            "openshift_api_for_data_protection:oadp/oadp-kubevirt-velero-plugin-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-rhel9-operator",
            "openshift_api_for_data_protection:oadp/oadp-velero-plugin-for-csi-rhel9"
          ]
        }
      ],
      "title": "github.com/kopia/kopia: Kopia: Arbitrary code execution via unauthenticated SFTP configuration in HTTP server."
    }
  ]
}